Additional environment-sensitive tests that inherited ADMIN_TOKEN:
- wsauth_middleware_test.go: 6 AdminAuth tests that expect fail-open
or bearer-token behavior without an ambient admin secret
- admin_test_token_route_test.go: fresh-install fail-open test
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Additional tests that inherited MOLECULE_ORG_ID or ADMIN_TOKEN from the
container environment and failed:
- registry_test.go: TestValidateAgentURL (strict RFC-1918 checks)
- security_regression_685_686_687_688_test.go: fresh-install fail-open
tests that need ADMIN_TOKEN unset to pass through the AdminAuth gate
- workspace_provision_test.go: issueAndInjectToken tests that verify
token injection into ConfigFiles (skipped in SaaS mode)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Tests in mcp_test.go assumed strict (non-SaaS) SSRF mode but inherited
MOLECULE_ORG_ID from the container environment, causing isSafeURL and
isPrivateOrMetadataIP to allow RFC-1918 ranges and fail.
Tests in admin_test_token_test.go assumed no ADMIN_TOKEN gate but
inherited ADMIN_TOKEN from the environment, causing 401 instead of
the expected 200/404.
Add t.Setenv guards to both files so each test controls its own
environment and passes regardless of ambient env vars.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Molecule AI Dev Engineer A (Kimi)